Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1447318

Re: [PATCH v1 3/3] cgroup: relax common ancestor restriction for direct descendants

From Tejun Heo <tj@kernel.org>
Newsgroups linux.kernel
Subject Re: [PATCH v1 3/3] cgroup: relax common ancestor restriction for direct descendants
Date 2016-07-20 18:00 +0200
Message-ID <rX24F-3jb-19@gated-at.bofh.it> (permalink)
References <rWjqV-8vS-9@gated-at.bofh.it> <rWjqW-8vS-31@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw

Hello, Aleksa.

On Tue, Jul 19, 2016 at 02:18:16AM +1000, Aleksa Sarai wrote:
> If we're moving from a parent to a direct descendant, the only end
> result (on cgroupv2 hierarchies) is that the process experiences more
> restrictive resource limits. Thus, there's no reason to restrict
> processes from moving to direct descendants based on whether or not they
> have cgroup.procs write access to their current cgroup.
> 
> This is important for unprivileged subtree management, as it allows
> unprivileged processes to move to their newly create subtrees.

I don't think we can do this as this allows a sub-cgroup to steal an
ancestor's process whether the ancestor likes it or not.  A process
being put in a context where it's more restricted without whatever is
managing that part of cgroup hierarchy is not ok, at all.  Please also
note that nobody expects its processes to be stolen underneath it.
This would be a management nightmare.

Thanks.

-- 
tejun

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH v1 0/3] cgroup: allow for unprivileged management Aleksa Sarai <asarai@suse.de> - 2016-07-18 18:20 +0200
  [PATCH v1 3/3] cgroup: relax common ancestor restriction for direct descendants Aleksa Sarai <asarai@suse.de> - 2016-07-18 18:20 +0200
    Re: [PATCH v1 3/3] cgroup: relax common ancestor restriction for  direct descendants Tejun Heo <tj@kernel.org> - 2016-07-20 18:00 +0200
      Re: [PATCH v1 3/3] cgroup: relax common ancestor restriction for  direct descendants Aleksa Sarai <asarai@suse.de> - 2016-07-21 01:00 +0200
        Re: [PATCH v1 3/3] cgroup: relax common ancestor restriction for  direct descendants Tejun Heo <tj@kernel.org> - 2016-07-21 01:10 +0200
          Re: [PATCH v1 3/3] cgroup: relax common ancestor restriction for  direct descendants Aleksa Sarai <asarai@suse.de> - 2016-07-21 01:20 +0200
            Re: [PATCH v1 3/3] cgroup: relax common ancestor restriction for  direct descendants Tejun Heo <tj@kernel.org> - 2016-07-21 01:20 +0200
              Re: [PATCH v1 3/3] cgroup: relax common ancestor restriction for  direct descendants Aleksa Sarai <asarai@suse.de> - 2016-07-21 09:50 +0200
                Re: [PATCH v1 3/3] cgroup: relax common ancestor restriction for  direct descendants Aleksa Sarai <asarai@suse.de> - 2016-07-21 16:40 +0200
                Re: [PATCH v1 3/3] cgroup: relax common ancestor restriction for  direct descendants Tejun Heo <tj@kernel.org> - 2016-07-21 17:10 +0200
                Re: [PATCH v1 3/3] cgroup: relax common ancestor restriction for  direct descendants "Serge E. Hallyn" <serge@hallyn.com> - 2016-07-21 17:10 +0200
                Re: [PATCH v1 3/3] cgroup: relax common ancestor restriction for  direct descendants "Serge E. Hallyn" <serge@hallyn.com> - 2016-07-21 16:40 +0200
                Re: [PATCH v1 3/3] cgroup: relax common ancestor restriction for  direct descendants James Bottomley <James.Bottomley@HansenPartnership.com> - 2016-07-21 17:00 +0200
                Re: [PATCH v1 3/3] cgroup: relax common ancestor restriction for  direct descendants Tejun Heo <tj@kernel.org> - 2016-07-21 17:00 +0200
                Re: [PATCH v1 3/3] cgroup: relax common ancestor restriction for  direct descendants Aleksa Sarai <asarai@suse.de> - 2016-07-21 17:10 +0200
                Re: [PATCH v1 3/3] cgroup: relax common ancestor restriction for  direct descendants Tejun Heo <tj@kernel.org> - 2016-07-21 17:10 +0200
                Re: [PATCH v1 3/3] cgroup: relax common ancestor restriction for  direct descendants Tejun Heo <tj@kernel.org> - 2016-07-21 17:00 +0200
                Re: [PATCH v1 3/3] cgroup: relax common ancestor restriction for  direct descendants James Bottomley <James.Bottomley@HansenPartnership.com> - 2016-07-21 17:10 +0200
                Re: [PATCH v1 3/3] cgroup: relax common ancestor restriction for  direct descendants Tejun Heo <tj@kernel.org> - 2016-07-21 17:10 +0200
                Re: [PATCH v1 3/3] cgroup: relax common ancestor restriction for  direct descendants James Bottomley <James.Bottomley@HansenPartnership.com> - 2016-07-21 17:20 +0200
                Re: [PATCH v1 3/3] cgroup: relax common ancestor restriction for  direct descendants Tejun Heo <tj@kernel.org> - 2016-07-21 17:30 +0200
                Re: [PATCH v1 3/3] cgroup: relax common ancestor restriction for  direct descendants James Bottomley <James.Bottomley@HansenPartnership.com> - 2016-07-21 17:40 +0200
                Re: [PATCH v1 3/3] cgroup: relax common ancestor restriction for  direct descendants Tejun Heo <tj@kernel.org> - 2016-07-21 18:00 +0200
                Re: [PATCH v1 3/3] cgroup: relax common ancestor restriction for  direct descendants James Bottomley <James.Bottomley@HansenPartnership.com> - 2016-07-21 20:20 +0200
                Re: [PATCH v1 3/3] cgroup: relax common ancestor restriction for  direct descendants Tejun Heo <tj@kernel.org> - 2016-07-21 23:10 +0200
                Re: [PATCH v1 3/3] cgroup: relax common ancestor restriction for  direct descendants Aleksa Sarai <asarai@suse.de> - 2016-07-22 10:30 +0200
                Re: [PATCH v1 3/3] cgroup: relax common ancestor restriction for  direct descendants Tejun Heo <tj@kernel.org> - 2016-07-25 20:40 +0200
                Re: [PATCH v1 3/3] cgroup: relax common ancestor restriction for  direct descendants Aleksa Sarai <asarai@suse.de> - 2016-07-22 10:20 +0200
                Re: [PATCH v1 3/3] cgroup: relax common ancestor restriction for  direct descendants Tejun Heo <tj@kernel.org> - 2016-07-25 20:50 +0200

csiph-web